Splunk Search

Not Reading Dropdown Form Tokens

Communicator

I'm trying to use two dropdowns, one to select a fiscal quarter and one to select the fiscal year. These are both based off of choices rather than search-populated, as so:

    <fieldset>
  <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
  </input>
  <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
  </input>
  </fieldset>

The problem I'm having comes from trying to use these. The URL happily contains:

?form.qDropMo=Q1&form.qDropYr=2015

but a simple eval statement such as:

| eval quarterStartMo=if($form.qDropMo$="Q1",7,quarterStartMo)

returns nothing. Even something like:

| eval quarter = $form.qDropMo$

returns nothing. I'm very confused as to why I can't pull the form information into my search.

0 Karma

Communicator

I've found the culprit. I have a |stats (etc) line in the full search that is somehow interfering. If I remove the |stats line this works normally. I have no idea why.

Revered Legend

Can you post the full query, in case removing that stats part affects your need. Just ignore this if you're fine without it.

0 Karma

Revered Legend

The dropdown values are string and they need to be enclosed within double quotes while using them.

So change the searches like this.

| eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)

and 

| eval quarter = "$form.qDropMo$"

Update

See this runanywhere sample with your example dropdowns and it works for me.

<form>
   <label>Token Issue</label>
  <fieldset>
    <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
    </input>
    <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>SampleData</title>
      <searchString>| stats count as quarterStartMo | eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)
| eval quarter = "$form.qDropMo$"</searchString>
      <earliestTime>-15m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

Communicator

I've tried with and without the double quotes. It doesn't seem to make a difference here.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!